Sigma rule: Execution Of Non-Existing File

Rule

Title

Execution Of Non-Existing File

Status

test

Level

high

Author

Max Altgelt (Nextron Systems)

Date

2021-12-09

Modified

2026-07-05

File

rules/windows/process_creation/proc_creation_win_susp_image_missing.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects process creation events where the Image field lacks an absolute path,
which occurs when the backing file no longer exists on disk at the time of
logging - commonly caused by Process Ghosting or other unorthodox process creation techniques.

Log source

product

windows

category

process_creation

Detection

filter_main_image_absolute_path:
    Image|contains: '\'
filter_optional_null:
    Image: null
filter_optional_empty:
    Image:
        - '-'
        - ''
filter_optional_4688:
    - Image:
          - 'MemCompression'
          - 'Registry'
          - 'System'
          - 'vmmem'
          - 'vmmemWSL'
    - CommandLine:
          - 'MemCompression'
          - 'Registry'
          - 'vmmem'
          - 'vmmemWSL'
condition: not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.stealth
• attack.privilege-escalation
• attack.t1055

MITRE ATT&CK ids this rule names

• T1055

References

• https://pentestlaboratories.com/2021/12/08/process-ghosting/
• https://www.elastic.co/blog/process-ghosting-a-new-executable-image-tampering-attack

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_susp_image_missing.yml